Use of bank cards, credit cards, debit cards or cash cards for making payments is becoming more and more frequent. These payment systems are relatively secure because they employ extensive security mechanisms. Usually a secret code must be provided by a purchaser and authenticated by a bank, to authorise the movement of funds from the purchaser's account to the vendor. Recent years have seen rapid growth in the use of credit cards and/or debit cards to purchase merchandise at point-of-sale locations, through public telephones or over the Internet. During these purchase transactions, some personal data is publicly released, albeit in a very limited way.
However, in view of the inherently public nature of telephone networks and/or the Internet, this personal information is at risk of interception. Identity theft is recognised as an increasingly important crime, wherein, despite all of the security checks used to authenticate and protect personal information, a credit/debit card may be cloned and used by malicious persons to rob money from the bank account of a legitimate user. In fact, in view of the almost instantaneous nature of today electronic transactions, even temporary ownership of a credit (or other payment) card could allow a malicious user to make a large number of payments either particularly through Internet.
US patent application Publication No. US2006/0131390 describes a system for providing a notification of a pending transaction request and obtaining an authorisation therefore from a cardholder. The system includes a phone number of a mobile device assigned to receive an authorisation request for a respective account. When a transaction request is received, the system identifies the phone number of the mobile device assigned to receive authorisation. request messages for the account requesting the transaction. The system generates and transmits an authorisation request message to the determined phone number; and a reply message is returned from the mobile device which explicitly indicates if the user of the mobile device approves or refuses this transaction.
In a similar vein, US patent application Publication No. US2004/0177040 describes a method for securing a card transaction using a mobile device which is capable of preventing the card from being embezzled and counterfeited.
Both US2006/0131390 and US2004/0177040 effectively use a mobile device to send an authorisation request and await a reply message to authorise a payment request. Thus, these systems require:                an available mobile phone network to process the payment request;        a payment area which has a valid network signal (which is not always available in multi level stores); and        an interaction with the user who must reply to the authorisation request.        
Other known prior art methods for enhancing the security of electronic payments are described in US applications Publication Nos. US2007/0080211 and US2007/0086469. However, these methods require some additional checks on shopping date, expense amount, user identity or supplementary secret code for payment authorization.
To solve the drawbacks of the prior art system, a co-pending application (same inventors, Filed in Europe as application number 08158820.4, also filed as U.S. application Ser. No. 12/486,073, entitled Authorizing An Electronic Payment Request) discloses a method and system for authenticating an electronic payment request made at a shop or point of sale with an additional layer of security being executed through an external device carried by the purchaser themselves. It would be desirable to extend a similar additional layer of security to those transactions which are completed through the web, without the need of a dedicated cash or sale terminal. It should be possible to complete these kinds of transactions from, for example, a home computer over the Internet.